Allow audit admins through backend admin auth

apps/aether-gateway/src/control/auth/credentials.rs

@@ -153,7 +153,7 @@ pub(super) fn extract_trusted_admin_headers(
     let user_role = header_value_str(headers, crate::constants::TRUSTED_ADMIN_USER_ROLE_HEADER)?
         .trim()
         .to_string();
-    if !user_role.eq_ignore_ascii_case("admin") {
+    if !crate::roles::can_access_admin_console(&user_role) {
         return None;
     }
     let session_id = header_value_str(headers, crate::constants::TRUSTED_ADMIN_SESSION_ID_HEADER)
@@ -171,7 +171,7 @@ pub(super) fn extract_trusted_admin_headers(
 
     Some(GatewayTrustedAdminHeaders {
         user_id,
-        user_role: "admin".to_string(),
+        user_role,
         session_id,
         management_token_id,
     })
@@ -563,6 +563,42 @@ mod tests {
         );
     }
 
+    #[test]
+    fn extracts_trusted_audit_admin_headers() {
+        let mut headers = http::HeaderMap::new();
+        headers.insert(
+            crate::constants::GATEWAY_HEADER,
+            "rust-phase3b".parse().unwrap(),
+        );
+        headers.insert(
+            crate::constants::TRUSTED_ADMIN_USER_ID_HEADER,
+            "audit-admin-1".parse().unwrap(),
+        );
+        headers.insert(
+            crate::constants::TRUSTED_ADMIN_USER_ROLE_HEADER,
+            "audit_admin".parse().unwrap(),
+        );
+        headers.insert(
+            crate::constants::TRUSTED_ADMIN_SESSION_ID_HEADER,
+            "sess-audit-1".parse().unwrap(),
+        );
+
+        let extracted = extract_request_credentials(
+            &headers,
+            &uri("/api/admin/endpoints/health/api-formats"),
+            "admin:endpoints_health",
+        );
+        assert_eq!(
+            extracted.trusted_admin_headers,
+            Some(GatewayTrustedAdminHeaders {
+                user_id: "audit-admin-1".to_string(),
+                user_role: "audit_admin".to_string(),
+                session_id: Some("sess-audit-1".to_string()),
+                management_token_id: None,
+            })
+        );
+    }
+
     #[test]
     fn ignores_trusted_admin_headers_without_gateway_marker() {
         let mut headers = http::HeaderMap::new();

apps/aether-gateway/src/control/auth/resolution.rs

@@ -273,7 +273,7 @@ async fn resolve_local_admin_principal(
     if claims
         .get("role")
         .and_then(Value::as_str)
-        .is_some_and(|role| !role.eq_ignore_ascii_case("admin"))
+        .is_some_and(|role| !crate::roles::can_access_admin_console(role))
     {
         return Ok(None);
     }
@@ -300,7 +300,7 @@ async fn resolve_local_admin_principal_from_claims(
     let Some(user) = state.find_user_auth_by_id(user_id).await? else {
         return Ok(None);
     };
-    if !user.is_active || user.is_deleted || !user.role.eq_ignore_ascii_case("admin") {
+    if !user.is_active || user.is_deleted || !crate::roles::can_access_admin_console(&user.role) {
         return Ok(None);
     }
 
@@ -329,7 +329,7 @@ async fn resolve_local_admin_principal_from_claims(
 
     Ok(Some(GatewayAdminPrincipalContext {
         user_id: user.id,
-        user_role: "admin".to_string(),
+        user_role: user.role,
         session_id: Some(session.id),
         management_token_id: None,
         management_token_permissions: None,

apps/aether-gateway/src/handlers/proxy/mod.rs

@@ -228,7 +228,7 @@ async fn maybe_promote_management_token_admin_principal(
     let Some(user) = state.find_user_auth_by_id(&token_with_user.user.id).await? else {
         return Ok(());
     };
-    if !user.is_active || user.is_deleted || !user.role.eq_ignore_ascii_case("admin") {
+    if !user.is_active || user.is_deleted || !crate::roles::can_access_admin_console(&user.role) {
         return Ok(());
     }
     let management_token_permissions = match management_token_permission_keys_from_value(